CVE-2026-82994: Oracle Platform Security Auth Bypass Flaw

CVE-2026-82994 Overview

CVE-2026-82994 is an authentication weakness [CWE-287] in Oracle Platform Security for Java, a component of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and is reachable over the network via Lightweight Directory Access Protocol (LDAP). Oracle rates the issue as easily exploitable by an unauthenticated attacker. Successful exploitation results in full takeover of Oracle Platform Security for Java, compromising confidentiality, integrity, and availability.

Critical Impact
An unauthenticated remote attacker can take over Oracle Platform Security for Java over LDAP, leading to complete compromise of the affected service.

Affected Products

Oracle Platform Security for Java 12.2.1.4.0
Oracle Platform Security for Java 14.1.2.0.0
Oracle Fusion Middleware deployments bundling the Centralized Thirdparty Jars component

Discovery Timeline

2026-09-15 - CVE-2026-82994 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82994

Vulnerability Analysis

The vulnerability affects Oracle Platform Security for Java (OPSS), which supplies authentication, authorization, and credential services to Oracle Fusion Middleware workloads. According to the Oracle advisory, the flaw sits in the Centralized Thirdparty Jars component and is triggered through the LDAP protocol. An unauthenticated attacker with network reachability to the LDAP interface can compromise OPSS without user interaction. Because OPSS mediates identity decisions for downstream Fusion Middleware services, a successful attack undermines security controls across dependent applications.

Root Cause

Oracle categorizes the issue under improper authentication [CWE-287]. The Centralized Thirdparty Jars component fails to correctly validate identity claims presented during LDAP-driven authentication flows. As a result, an attacker can bypass the intended authentication logic and act as a trusted principal within OPSS. Oracle has not published low-level technical details, consistent with its Critical Patch Update disclosure practice.

Attack Vector

Exploitation requires network access to the LDAP interface exposed by the affected OPSS deployment. No credentials, privileges, or user interaction are required. The attacker sends crafted LDAP traffic that abuses the authentication weakness in the Centralized Thirdparty Jars component. A successful request yields control of OPSS, which can be used to manipulate policies, read secrets, or pivot into other Fusion Middleware services that trust OPSS decisions.

See the Oracle Security Alert CSPUSEP2026 for vendor guidance. No public proof-of-concept code has been observed at the time of writing.

Detection Methods for CVE-2026-82994

Indicators of Compromise

Unexpected inbound LDAP or LDAPS connections to Oracle Fusion Middleware hosts from untrusted network segments.
New or modified OPSS policy store entries, credential store keys, or system-jazn-data.xml records without a corresponding change request.
Authentication events in OPSS logs where subjects assert privileged roles without a preceding successful credential validation.
Outbound connections from WebLogic or Fusion Middleware managed servers to attacker-controlled LDAP endpoints.

Detection Strategies

Baseline LDAP client and server traffic for OPSS-integrated hosts, then alert on volume spikes, malformed binds, or connections from non-application subnets.
Correlate OPSS audit logs with WebLogic access logs to identify authorization decisions that lack a matching authentication event.
Monitor JVM process behavior on Fusion Middleware nodes for unexpected class loading from the Centralized Thirdparty Jars directory.

Monitoring Recommendations

Forward OPSS, WebLogic, and host telemetry into a central analytics platform for cross-source correlation and historical search.
Enable OPSS audit policies at the level required to capture authentication, authorization, and credential store access events.
Alert on configuration drift in jps-config.xml, system-jazn-data.xml, and credential wallets on all Fusion Middleware nodes.

How to Mitigate CVE-2026-82994

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to LDAP and LDAPS listeners used by OPSS so that only trusted application hosts can connect.
Rotate credentials, keys, and secrets stored in OPSS credential and key stores on any host that could not be immediately patched.
Review OPSS policy and credential store contents for unauthorized modifications since the vulnerability disclosure.

Patch Information

Oracle addressed CVE-2026-82994 in the Critical Security Alert tracked as CSPUSEP2026. Administrators should apply the patches for Oracle Platform Security for Java versions 12.2.1.4.0 and 14.1.2.0.0 as documented in the Oracle Security Alert CSPUSEP2026. Follow Oracle's documented Fusion Middleware patching procedure, including OPatch prerequisites and post-patch validation.

Workarounds

Place OPSS LDAP interfaces behind network segmentation or firewall rules that permit only vetted client hosts.
Terminate LDAP traffic at an authenticating reverse proxy or LDAP firewall capable of enforcing schema and bind restrictions.
Disable or remove unused Fusion Middleware components that depend on the Centralized Thirdparty Jars pathway when feasible until patches are deployed.

bash

# Example: restrict LDAP access to Fusion Middleware hosts using iptables
iptables -A INPUT -p tcp --dport 389 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 636 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP